CVE-2026-89176

Howyar｜WeenyGenius - Missing Authentication

Published Sep 11, 2026 CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Description

WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the same network can easily spoof student or teacher endpoints. Impersonating a student can disrupt normal classroom operations, whereas impersonating a teacher can induce student computers to initiate connections, thereby gaining remote control over the student endpoints.

Analysis

Technical impact

The vulnerability is a missing authentication flaw (CWE-306) that allows an attacker with local network access to spoof both student and teacher endpoints in WeenyGenius. Without needing credentials, the attacker can impersonate a student to disrupt normal classroom activities, or impersonate a teacher to trigger student computers to open connections, thereby enabling remote control of those endpoints.

Affected Systems

The vulnerability affects Howyar Technologies’ WeenyGenius computer lab management system on all versions released before 12.3.033. Users of earlier builds running on local networks are at risk.

Risk and Exploitability

With a CVSS score of 8.7, this flaw represents a high severity weakness. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The vulnerability can be exploited by a local network attacker with no authentication, allowing direct impersonation of users and remote control of endpoints. The lack of authentication makes it straightforward once the attacker gains network access.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Howyar

WeenyGenius

unaffected

Version	Status	Constraints
`0`	affected	≤ 12.2.031

No data.

Vendor Product Versions

Howyar

Weenygenius

Version	Status	Scheme	Platform
`[0,12.2.031]`	affected	semver	—

Remediation

Vendor Solution

Update to version 12.3.033 or later.

OpenCVE Recommended Actions

Update WeenyGenius to version 12.3.033 or later.
Restrict network access to the WeenyGenius server to trusted hosts only.
Enable logging and monitor for suspicious endpoint connections or spoofing attempts.

Generated by OpenCVE AI on September 11, 2026 at 09:51 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.400% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.twcert.org.tw/en/cp-139-11200-ffc3c-2.html
https://www.twcert.org.tw/tw/cp-132-11201-658c0-1.html

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Howyar Howyar weenygenius
Vendors & Products		Howyar Howyar weenygenius

Sep 11, 2026 7:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the same network can easily spoof student or teacher endpoints. Impersonating a student can disrupt normal classroom operations, whereas impersonating a teacher can induce student computers to initiate connections, thereby gaining remote control over the student endpoints.
Title		Howyar｜WeenyGenius - Missing Authentication
Weaknesses		CWE-306
References		https://www.twcert.org.tw/en/cp-139-11200-ffc3c-2.html https://www.twcert.org.tw/tw/cp-132-11201-658c0-1.html
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`